Cawdog

CAWODOG – Python 기반 산업용 AI를 위한 IP 보호 PoC CAWODOGCat World Dominance Group는 오프라인 산업용 기계에 배포된 Python 기반 AI 모델 을 보호하기 위한 장난스럽지만 현실적인 개념 증명입니다. 핵심 아이디어: 개CAWODOG의 '적'를 감지하는 작은 이미지 분류기를 가져와 간단한 앱에 담은 다음, 점진적으로 강화 하여 IP 도용에 대비하는 것입니다. 이 PoC는 다음 주제에 대한 내부 백서의 동반 자료로 설계되었습니다: 오프라인 산업용 AI 배포를 위한 Python IP...

trivysupplychainanalysis

Quantitative Analysis of Multi-Stage CI/CD Supply-Chain Attacks 형식적으로 검증되고 정량적으로 재구성된 2026년 3월 Trivy / "TeamPCP" GitHub Actions 공급망 침해 CVE-2026-33634 — TLA+로 모델링, TLC로 철저히 확인, PRISM 확률 모델 검사기로 정량화. 논문의 모든 숫자는 이 저장소에서 재생성됩니다. 모델, 확률, 코퍼스 측정값, 보정 모두 레이어당 단일 명령어로 소스에서 재현됩니다. 발생한 일과 이를 통해 입증된 것 널리 사용...

Oihk-pentesting

OIHK-pentesting OIHK-pentesting is an autonomous multi-agent engine for authorized security assessments. A root planner delegates to recon, discovery, attack Privesc, validation, and reporting agents — and the engine itself enforces scope, egress, evidence, and resource policy no matter which mod...

CVE-2025-54135

다음은 Cursor IDE의 CVE-2025-54135 취약점에 대한 완전한 기능의 익스플로잇으로, Model Context Protocol MCP 구성을 조작하여 원격 코드 실행을 달성하는 프롬프트 인젝션 공격을 시연하기 위해 설계되었습니다. 이 코드는 공격자가 피해자의 Cursor IDE가 상호 작용하도록 구성된 공개 Slack 채널 또는 유사한 외부 MCP 서버에 접근할 수 있다고 가정합니다. 익스플로잇은 /.cursor/mcp.json 파일을 다시 작성하여 개발자 권한 하에 임의의 명령을 실행하는 악성 프롬프트를...

CVE-2026-79657

A flaw was found in NLTK. This vulnerability allows a remote attacker to achieve arbitrary code execution by supplying a specially crafted model or tokenizer artifact for the application to process. The issue occurs because the deserialization allowlist mechanism permits entire software namespace...

CVE-2026-23744-MCPJAM-RCE-exploit

CVE-2026-23744-MCPJAM-RCE-exploit このPythonの概念実証コードは、対象アプリケーションが公開する脆弱なMCP（Model Context Protocol）サービスを標的としています。この脆弱性により、攻撃者は /api/mcp/connect エンドポイントを通じて任意のサーバー設定パラメータを提供できます。 影響を受けるエンドポイント POST /api/mcp/connect 使用するツールと技術 Python 3 requestsライブラリ HTTP/JSON API通信 MCPサービスインターフェース 実行 依存関係をインストール: pip...

CVE-2026-100308

A flaw was found in GluonTS. The model loading component fails to safely handle untrusted data during deserialization, which can allow an attacker to execute arbitrary commands with the privileges of the running process. An attacker can exploit this issue by convincing a user or system to load a...

CVE-2026-100308

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

cve-2026-75650-magento-validation-lab

CVE-2026-75650 / VULN-39341 Docker validation lab This standalone lab reproduces the complete unauthenticated StyleSmuggler HTTP chain on a revision-pinned Magento Open Source 2.4.9 checkout. It then applies Adobe's VULN-39341 patch and proves that the identical request sequence no longer reaches...

CVE-2026-102567

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

CVE-2026-102566

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

0

セキュリティ研究のための、オープンソースで自己進化するマルチモデルハーネス。 Swiss Applied AI & Cybersecurity Research Lab 0.security · ドキュメント · FoxGuard 私たちの研究成果を支えるハーネス。 ソフトウェアの最も深い層にある新規脆弱性を発見します。Linuxカーネルにおける研究を含む、私たちの 公開開示とアップストリーム修正をご覧ください。 はじめに エージェント向けドキュメント このプロンプトをコーディングエージェントにコピーしてください: https://0.security/harness/setup.md...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308

The Amazon GluonTS library is vulnerable to arbitrary command execution in versions prior to 0.17.0 . The root cause is the deserialization of untrusted data within the model loading component, which may allow context-dependent attackers to execute OS commands with the privileges of the loading p...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

EUVD-2026-88967

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

CVE-2026-102567 CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

CVE-2026-102567 CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

CVE-2026-102566 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...